KOSTOCK is a Flutter prototype for stock quotes, news, watchlists and Q&A. It also implements sign-in, order-entry forms and sample asset screens. It does not execute brokerage orders or connect real accounts.

User capabilities

• Sign in through Firebase Auth with email and password, Google or an anonymous session.
• Read and refresh AAPL and MSFT quotes from Alpha Vantage on the home and current-price screens.
• Browse the NEWS_SENTIMENT feed and add items to an in-memory Provider watchlist.
• Explore order, automatic-monitoring and sample asset interfaces.
• Send questions to an external chatbot endpoint and view the in-session conversation.

Ownership

The work covers Flutter structure, dark-theme screens, six tabs, Firebase initialization and authentication, REST requests and JSON parsing, Provider state and chatbot UI. Android, iOS and macOS runner configuration is also present.

Current status

The repository publishes a v0.0.1-alpha learning prototype. Brokerage execution, account integration, persistent watchlists and production observability are outside the implemented scope. User outcomes and performance are not measured.

1. Bootstrap and identity boundary

main.dart initializes the Flutter binding and Firebase, then injects InterestProvider through MultiProvider. LoginPage calls Firebase Auth directly for email, Google and anonymous credentials. Successful authentication replaces the route with MainPage; logout and account deletion use the same Firebase session boundary.

2. Presentation and state boundary

MainPage switches among home, news, watchlist, order, assets and current-price screens with a BottomNavigationBar. An IndexedStack retains those widgets across tab changes. Shared watchlist entries live in a ChangeNotifier-based InterestProvider, but no disk or Firestore adapter persists them, so a process restart resets the list.

3. Quote and news read path

Home calls GLOBAL_QUOTE, the quote screen calls TIME_SERIES_INTRADAY, and news calls NEWS_SENTIMENT directly from the Flutter client. Each screen checks the HTTP status and maps JSON straight into view state. Exceptions end loading and expose a local error path, but there is no shared API client, cache or retry policy.

4. Chat path

XsChatbotPage sends a JSON POST to an external /question endpoint and reads template.outputs[0].simpleText.text into the in-memory chat list. The view exposes loading and error text, but conversation history is not persisted and there is no provider fallback.

5. Trust and failure boundaries

Firebase owns identity; Alpha Vantage and the chatbot server are independent availability boundaries. API calls and credentials are currently coupled to client code, so a production version would require a server proxy, secret management, rate limiting and a structured error contract. Order and asset screens are simulations and never create financial transactions.

6. State and data ownership

Firebase owns the identity session, Provider owns the watchlist, and each tab State owns selection and response data. A broker ledger or persisted order state is missing; portfolio and order screens are local presentation state only.

7. Performance and external-API recovery

Quote and news calls are exposed to rate limits and network latency. Request deduplication, short symbol caches, timeout and retry budgets, and stale-data labeling are required; chatbot failure should remain isolated from market exploration.

8. Security, observability and debt

API keys and the chatbot endpoint should move out of the client, with TLS, input length and response-schema validation. Unified telemetry and error classification are missing. Financial accuracy and latency metrics have not been measured.

Use Flutter across platform runners

Flutter keeps Android, iOS and macOS presentation in one codebase while the prototype validates screens and networking. This favors delivery speed over platform-specific optimization.

Delegate identity to Firebase

Firebase Auth supplies email, Google and anonymous sessions without a custom identity server. It narrows the implementation but makes Firebase configuration and platform OAuth part of deployment.

Retain tabs with IndexedStack

Six screens remain alive instead of being rebuilt on every switch. Navigation state is predictable, while larger future screens would require control over retained memory and startup work.

Keep watchlists in Provider memory

ChangeNotifier makes cross-screen state explicit at small scale. The absence of a persistence adapter keeps the prototype simple but loses watchlists when the application exits.

Call external APIs from the client

Direct calls made quote, news and chatbot integration quick. The cost is that key protection, response normalization, rate limiting and retry are not centralized. A backend proxy is the safer production alternative.

Reproducible manual scenarios

1. With valid Firebase configuration, verify that email, Google and anonymous sessions reach the main shell.
2. Move through all six tabs and confirm that IndexedStack retains each screen’s state.
3. Exercise quote and news success, empty response, rate-limit and offline paths.
4. Toggle a news watch item, verify Provider synchronization and confirm the current reset-on-restart contract.
5. Exercise chatbot success, malformed response and endpoint timeout.
6. Verify that logout and account deletion return to authentication.

Automated evidence

The repository includes Flutter lint configuration and platform Runner test skeletons, but no confirmed Dart unit or integration suite for identity, data or order flows. Regression stability, API success rate, frame performance and accessibility are therefore not measured.

Known limits

• Quote symbols and parts of the home content are fixed rather than a complete Korean-market universe.
• Watchlists, chat and order input are not persisted.
• Direct client API calls expose credential and rate-limit risks.
• Alpha Vantage and the chatbot endpoint directly affect feature availability.
• Order and asset views are examples, not brokerage or execution integrations.

Completed

• Flutter dark theme and six primary tabs
• Firebase email, Google and anonymous authentication
• Alpha Vantage quote and news reads
• Provider watchlist sharing
• Order, monitoring and asset prototype screens
• External Q&A chatbot and alpha release

Priority improvements

• Move API credentials and calls behind a server proxy
• Introduce a shared client, timeout, retry and error contract
• Persist watchlists and user settings
• Separate direct view networking into repository, service and view-model boundaries
• Add tests for authentication, parsing, state and navigation

Later work

• Searchable symbol universe and market mapping
• Accessibility labels, large text and screen-reader validation
• Cache and offline last-known data
• Endpoint observability and privacy documentation

Out of scope

Real order execution, investment advice, guaranteed returns and brokerage custody are not part of this prototype. They require financial compliance, security review and a separate server architecture.